Contradicting permissions with two user roles (in Role Permissions Manager)

Let’s say I have two users (A and B) with role Purchase User. If I want one user (A) to entertain all its permissions and want to restrict creating Purchase Order for another user (B), how to I achieve this ?

Could you elaborate little more?

Assume two employees both have role Purchase User. By default, a Purchase User is allowed to create PO. But I want employee A to be able to create PO (default - no change needed for this) but I want to restrict user B (who is also a Purchase User) from creating PO (need solution to this).

You can use the perm level to achieve this.

There are various ways you can achieve this.

One is to create a new role say “Purchase user non PO” from Role List, and set user role permissions identical to the role “Purchase User” but deselect the “Create” checkbox against the “PO” doctype.
Assign role “Purchase user non PO” to employee B.

Another was is to assign Employee A “Purchase Manager”, while to Employee B “Purchase User”. There after for user role “Purchase User” remove the permission to create a PO.

I was aware of both these ways. I was actually wondering if there were some better ways. Anyway, this solves the problem. Thank you.